Embed the agent within the hypervisor, instead of guest VM
Open
enhancement
- Dominant language
- Go
- Stars
- 17
- Forks
- 2
- PR merge metrics
- No merged PRs in 30d
Description
Advanced malware can detect agents being installed, which means it can decide not to run or to trick the analysis. Another approach could be injecting the agent directly into the hypervisor, to avoid being detected. The agent would then observe what is going on in the VM.
- https://ieeexplore.ieee.org/document/8635598
- https://vmxray.com/
Purpose of this issue is to investigate how this could be done.
Contributor guide
No contributing guide indexed for this repository
Assessment
This issue has not been assessed yet.